Review, peer-check, sign off, with the working preserved.

What it is

MARSAD's workflow layer is the part of the platform that turns artefacts (findings, attestations, tests, vendor incidents, framework assessments, MVB declarations) into things that move through a defined review-and-sign-off path with an audit trail attached.

It is not a separate tool, and it is not the same shape on every artefact. The shape is matched to what each artefact actually needs.

Why a workflow layer at all

A regulator looking at a sign-off does not just want to see the sign-off, they want to see that the right reviewers saw it at the right time, that there was a peer check, and that the trail is durable. A spreadsheet with three names at the bottom does not produce that confidence.

Internally, the workflow layer is also what stops important work from quietly stalling. An attestation with no owner, a finding past its due date, a framework assessment that nobody has progressed in three months, these surface automatically rather than dying in someone's inbox.

How MARSAD frames it

Each artefact gets a workflow template that fits its risk posture. Some artefacts need a single owner and a peer reviewer. Some need parallel sign-off, chief risk officer and accountable executive on the same declaration, both visible. Some need a lighter touch, an action assigned to an owner with a due date and an automatic chase.

Around the workflow itself, three supports run continuously:

• Notifications route transitions to the right people on the right channels. Per-user opt-outs and a digest mode mean the platform doesn't become a noise source.
• An immutable audit log captures every state change, every comment, every owner reassignment. The log is append-only and surfaces as a timeline panel on each artefact.
• A "My Work" feed rolls up everything a given user owns or has been asked to review. It is the page most operators land on each morning.

What customers see

• Workflow controls embedded on each artefact's detail panel, the relevant transitions visible, the forbidden ones not visible at all.
• An audit timeline on every artefact showing the full history of state changes, comments, and assignments.
• The "My Work" feed at /my-work, the daily landing page for active operators, with overdue items pinned and the next-due ones near the top.
• Configurable per-framework workflow templates in admin settings, so the operating team chooses the pattern rather than living with a default.